CVE-2026-25594 InvoicePlane has Stored XSS via Family Name in Product Form

InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. A Stored Cross-Site Scripting XSS vulnerability exists in InvoicePlane 1.7.0 via the Family Name field. The familyname value is rendered without HTML encoding inside the family dropdown on the...

@adobe-apimesh/mesh-builder (1.4.0-beta.5), @akylas/nativescript-cli (>=8.7.2, <=8.8.2) +317 more potentially affected by CVE-2026-26996 via minimatch (>=7.0.0, <=7.4.6)

minimatch NPM version =7.0.0, =8.7.2, =5.5.0-682, =0.0.6, =3.6.0-next.1592614713.e5a4c4ab6a0ebf5dabac13d0a67422c28ed97f47, =2.6.0-next.1592627998.ea50ce98dfc72570fa6223d6c3754d6008fedd71, =2.5.0-next.1592629701.b7cf67ae0ec0a60f7a9abacdde474cb691004fe0,...

7ghost-cli (>=1.17.6-next.0, <=1.18.4), @agentuity/evals (>=0.0.104, <=2.0.30) +395 more potentially affected by CVE-2026-26280 via systeminformation (>=5.0.6, <=5.30.7)

systeminformation NPM version =5.0.6, =1.17.6-next.0, =0.0.104, =3.0.0-alpha.0, =0.0.6, =0.0.63, =0.0.2, =3.0.0-alpha.0, =0.1.1, =0.1.1, =4.1.0-rc.4, =4.0.0-devnet.2-patch.0, =0.0.1-2.1-beta-provision, =1.0.10, =0.0.0-test.0, =6.0.0-nightly.20260812 and more Source cves: CVE-2026-26280 Source...

WordPress plugin EventPrime 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

📄 PaperCut MF/NG 25.0.5 Authentication Bypass / Remote Code Execution

A critical security vulnerability was discovered in version 25.0.5 of PaperCut MF/NG that allows attackers to bypass authentication and execute remote commands on the target system without requiring any credentials...

PT-2026-20264

Name of the Vulnerable Software and Affected Versions jizhicms version 2.5.6 Description The software contains a SQL Injection issue in the 'Article/deleteAll' and 'Extmolds/deleteAll' functionalities. The issue is triggered through the data parameter. Recommendations Update to a newer version th...

COMFAST CF-N1 命令注入漏洞

COMFAST CF-N1 is a wireless router produced by COMFAST Corporation. The Comfast CF-N1 V2 2.6.0.2 version has a command injection vulnerability. This vulnerability stems from incorrect handling of the parameter “bandwidth” in the function sub44AC4C within the file...

PT-2026-31524

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A flaw exists in the Google Chrome Omnibox address bar related to user interface information presentation errors. Successful exploitation could allow a remote attacker to conduct spoofi...

CVE-2019-25323

Heatmiser Netmonitor v3.03 contains an HTML injection vulnerability in the outputSetup.htm page that allows attackers to inject malicious HTML code through the outputtitle parameter. Attackers can craft specially formatted POST requests to the outputtitle parameter to execute arbitrary HTML and...

modern-web-swiss-army-knife (>=2.7.0, <=2.7.2) potentially affected by CVE-2025-56647 via @farmfe/core (1.6.6)

@farmfe/core NPM version 1.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on @farmfe/core and may be impacted: - modern-web-swiss-army-knife =2.7.0, =2.7.2 Source cves: CVE-2025-56647 Source advisory: SNYK:JS-FARMFECORE-15282805...

QNAP Systems File Station 5 安全漏洞

QNAP Systems File Station 5 is a file management system developed by QNAP Systems, a company based in Taiwan, China. Versions of QNAP Systems File Station 5 prior to 5.5.6.5068 contained security vulnerabilities. These vulnerabilities stemmed from unlimited resource allocation without any...

CVE-2025-71154 affecting package kernel for versions less than 6.6.121.1-1

CVE-2025-71154 affecting package kernel for versions less than 6.6.121.1-1. An upgraded version of the package is available that resolves this issue...

0xgasless-mcp (>=1.0.3, <=1.0.5), 4d-vector-search (>=1.0.0, <=1.0.1) +2202 more potentially affected by CVE-2026-25528 via langsmith (>=0.3.71, <=0.3.87)

langsmith NPM version =0.3.71, =1.0.3, =1.0.0, =1.11.0, =0.0.5, =0.0.1, =1.0.0, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.65, =1.0.6, =0.0.1, =0.0.1, =2.0.0, =2.2.0 - @adb-storage-m/mem0ai 2.3.2 and more Source cves: CVE-2026-25528 Source advisory: OSV:GHSA-V34V-RQ6J-CJ6P...

CVE-2025-10464 Cleartext password storage in Birtech Information Technologies' Sensaway

Insecure Storage of Sensitive Information vulnerability in Birtech Information Technologies Industry and Trade Ltd. Co. Senseway allows Retrieve Embedded Sensitive Data. This issue affects Senseway: through 09022026. NOTE: Because the product was developed using outdated technology, the...

EUVD-2026-5818

A vulnerability was determined in BurtTheCoder mcp-maigret up to 1.0.12. This affects an unknown part of the file src/index.ts of the component searchusername. Executing a manipulation of the argument Username can lead to command injection. The attack may be launched remotely. Upgrading to versio...

PT-2026-7008

Name of the Vulnerable Software and Affected Versions code-projects Contact Management System version 1.0 Description A security issue exists in code-projects Contact Management System. The problem involves the processing of the index.py file and manipulation of the selecteditem0 argument, leadin...

PT-2026-6938

Name of the Vulnerable Software and Affected Versions UTT HiPER 810 version 1.7.4-141218 Description A flaw exists in the rehttpd component of UTT HiPER 810. Specifically, the sub 4407D4 function within the /goform/formReleaseConnect file is susceptible to command injection. Manipulating the Isp...

@kimuson/claude-code-viewer (>=0.4.2-beta.2, <=0.5.9), @machina.at/cli (>=19.24.1, <=19.43.0) +20 more potentially affected by CVE-2026-25725 via @anthropic-ai/claude-code (>=2.0.0, <=2.0.76)

@anthropic-ai/claude-code NPM version =2.0.0, =0.4.2-beta.2, =19.24.1, =1.0.0-broken, =0.0.1-rc.1, =0.12.0, =0.5.2, =0.12.1, =0.0.0, =0.1.2, =1.9.1, =1.9.1, =1.9.6 and more Source cves: CVE-2026-25725 Source advisory: OSV:GHSA-FF64-7W26-62RF...

📄 WordPress User Registration and Membership 4.1.2 Authentication Bypass

Proof of concept exploit for WordPress User Registration and Membership plugin versions 4.1.2 and below. These versions contain a critical authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access to user accounts, including administrative privileges, b...

PT-2026-6791

Name of the Vulnerable Software and Affected Versions UTT 进取 520W version 1.7.7-180627 Description A flaw exists in UTT 进取 520W. A buffer overflow can occur in the strcpy function within the file /goform/formIpGroupConfig when the groupName argument is manipulated. This issue is remotely...